Quick Answer
How do you set up DMARC?
Make sure SPF and DKIM are configured first, then create a TXT
record in your DNS using the DMARC host
_dmarc.yourdomain.com. A safe starting policy is
v=DMARC1; p=none;. Save the record, allow time for DNS
propagation, and monitor authentication reports before increasing
enforcement.
What Is DMARC?
DMARC stands for Domain-based Message Authentication Reporting and Conformance.
It is an email security protocol that builds on SPF and DKIM. DMARC helps mailbox providers determine whether messages claiming to come from your domain are properly authenticated.
DMARC also tells receiving providers what to do when authentication fails, helping reduce unauthorized use of your domain for spoofing and phishing.
Set up SPF and DKIM first
DMARC is most effective when SPF and DKIM are already configured correctly for your legitimate sending sources.
DMARC at a Glance
Before You Begin
Confirm your legitimate sending setup before publishing or enforcing a DMARC policy.
- Make sure SPF is configured for your sending domain.
- Make sure DKIM is configured and working.
- Have access to the DNS provider managing your domain.
- Know whether you are configuring the root domain or a sending subdomain.
- Decide whether you want DMARC reports sent to a monitoring email address.
DMARC Policies: What Happens When Authentication Fails
p=none
Monitoring only. Messages are not rejected or quarantined because of the DMARC policy. This is a useful starting point while you collect authentication data.
p=quarantine
Messages that fail DMARC are treated as suspicious and may be routed to spam or otherwise quarantined by the receiving provider.
p=reject
Messages that fail DMARC can be rejected instead of being delivered.
Start by monitoring
Begin with p=none so you can review authentication
results first. Move to p=quarantine or
p=reject after confirming your legitimate senders
are authenticating correctly.
Step-by-Step: Add a DMARC TXT Record in DNS
Step 1: Prepare Your Sending Setup
Make sure the domain or subdomain is configured for sending and that SPF and DKIM records are present.
Step 2: Open Your DNS Provider
Log in to the service where your domain's DNS records are managed.
Step 3: Create a TXT Record
Add a new TXT record using the DMARC host or name required for your domain.
Step 4: Publish the DMARC Value
Save the record and allow time for DNS propagation. This may take only minutes, but in some cases can take up to 24 hours.
Step 5: Monitor the Results
If reporting addresses are included in the record, review the reports to confirm legitimate sending sources are authenticating correctly.
Starter DMARC example
Type: TXT Name/Host: _dmarc.yourdomain.com Value: v=DMARC1; p=none;
If you are using a sending subdomain, the host may be different,
such as _dmarc.communication. Use the exact format
required by your DNS provider and sending configuration.
How to Monitor DMARC Reports
DMARC reports can help you confirm that legitimate senders are passing authentication and identify unauthorized sources attempting to use your domain.
Aggregate Reports
The rua tag can send high-level summaries of
authentication results, often in XML format.
Forensic Reports
The ruf tag can request more detailed failure
information, although support varies by provider.
Increase Enforcement Carefully
After monitoring your legitimate senders, you can move from
p=none to p=quarantine and then to
p=reject when you are confident the configuration
is correct.
DMARC Best Practices
Frequently Asked Questions
What is DMARC?
What are DMARC policies?
How do I set up a DMARC record?
How do I monitor DMARC reports?
Continue Learning
Continue with related Email & SMTP guides for sending-domain authentication, deliverability, sender reputation, and mailbox provider requirements.
